CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime.
An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker.
Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Kafka Connectto a version that resolves this vulnerability.Fixed in 4.2.2 - Upgrade
Upgrade
Apache Kafka Connectto a version that resolves this vulnerability.Fixed in 4.3.2 - Upgrade
Upgrade
Apache Kafka Connectto a version that resolves this vulnerability.Fixed in 4.4.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Kafka Connect workers are exposed if an attacker can access the REST validation endpoint and configuration providers are installed on the worker. The issue can disclose plaintext values resolved by any installed provider.
What access does an attacker need?
An attacker needs access to the Connect REST API endpoint /connector-plugins/{connector-type}/config/validate. The provided information does not describe any additional authentication or privilege requirement.
What should we do if we cannot patch immediately?
Restrict access to the Kafka Connect REST API validation endpoint to trusted users and systems. This limits the ability to invoke configuration validation and retrieve provider-resolved plaintext values.
Which versions contain the fix?
Upgrade to Apache Kafka Connect 4.2.2, 4.3.2, 4.4.0, or a later version.